CVE-2022-45402mediumCWE-601

CVE-2022-45402: medium-severity vulnerability in Apache Airflow

Apache Airflow: Open redirect during login

Published · Updated

Follow this CVE+ Monitor Apache Airflow+ Monitor apache-airflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

35Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 81%
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Apache Software Foundation · Apache Airflow
Related CVEs — Apache Airflow

In the same product, most dangerous first.

CVE-2020-11978HIGHCVE-2020-11978EPSS 99.2%KEVCVE-2022-40127HIGHApache Airflow <2.4.0 has an RCE in a bash exampleEPSS 85.7%CVE-2021-38540—Apache Airflow: Variable Import endpoint missed authentication checkEPSS 80.9%CVE-2022-24288—Apache Airflow: RCE in example DAGsEPSS 78.4%CVE-2020-11981—CVE-2020-11981EPSS 36.8%CVE-2020-17526—CVE-2020-17526EPSS 23.9%